# HonestMX security and privacy

HonestMX stores address-level verification and finder records for a configurable retention period (90 days on the reference deployment) measured from creation and never renewed by cache reads. Attempts and Proof Receipts are deleted with their verification. Outcome feedback is deleted with the associated verification. Financial ledger entries and aggregate/non-personal domain observations remain, but do not contain the requested address.

Proof Receipts use a service-keyed HMAC recipient binding. It is pseudonymous, not anonymous, and is meaningful only with the authenticated subject-comparison endpoint. Raw SMTP transcripts and message content are neither returned nor placed in receipts. Metrics never use email addresses or unbounded remote text as labels.

API keys are stored as hashes, returned raw only when created, independently scoped, revocable, and optionally capped by daily/monthly billable exposure. Receipt and webhook private signing material is held in a mode-0600 file on the private durable data volume and must be included in encrypted backups. Public Ed25519 keys are intentionally discoverable.

Outbound verification blocks non-public MX addresses. Customer webhook endpoints require HTTPS, are resolved and validated on every attempt, reject private/reserved destinations, pin each attempt to validated addresses, follow no redirects, bound timeouts, ignore response bodies, retry finitely and disable after eight consecutive delivery attempts for an event. Signed events include `verification.completed`, `batch.completed`, `balance.low`, and `outcome.refund_approved`.

The live readiness surface is `/status`; detailed Prometheus metrics are not public. Security reports should use the private reporting channel published by the repository owner rather than placing credentials, addresses or exploit details in a public issue.